AWS::SecurityHub::AutomationRule MapFilter
A map filter for filtering AWS Security Hub findings. Each map filter provides the field to check for, the value to check for, and the comparison operator.
Syntax
To declare this entity in your AWS CloudFormation template, use the following syntax:
JSON
{ "Comparison" :
String
, "Key" :String
, "Value" :String
}
YAML
Comparison:
String
Key:String
Value:String
Properties
Comparison
-
The condition to apply to the key value when filtering Security Hub findings with a map filter.
To search for values that have the filter value, use one of the following comparison operators:
-
To search for values that include the filter value, use
CONTAINS
. For example, for theResourceTags
field, the filterDepartment CONTAINS Security
matches findings that include the valueSecurity
for theDepartment
tag. In the same example, a finding with a value ofSecurity team
for theDepartment
tag is a match. -
To search for values that exactly match the filter value, use
EQUALS
. For example, for theResourceTags
field, the filterDepartment EQUALS Security
matches findings that have the valueSecurity
for theDepartment
tag.
CONTAINS
andEQUALS
filters on the same field are joined byOR
. A finding matches if it matches any one of those filters. For example, the filtersDepartment CONTAINS Security OR Department CONTAINS Finance
match a finding that includes eitherSecurity
,Finance
, or both values.To search for values that don't have the filter value, use one of the following comparison operators:
-
To search for values that exclude the filter value, use
NOT_CONTAINS
. For example, for theResourceTags
field, the filterDepartment NOT_CONTAINS Finance
matches findings that exclude the valueFinance
for theDepartment
tag. -
To search for values other than the filter value, use
NOT_EQUALS
. For example, for theResourceTags
field, the filterDepartment NOT_EQUALS Finance
matches findings that don’t have the valueFinance
for theDepartment
tag.
NOT_CONTAINS
andNOT_EQUALS
filters on the same field are joined byAND
. A finding matches only if it matches all of those filters. For example, the filtersDepartment NOT_CONTAINS Security AND Department NOT_CONTAINS Finance
match a finding that excludes both theSecurity
andFinance
values.CONTAINS
filters can only be used with otherCONTAINS
filters.NOT_CONTAINS
filters can only be used with otherNOT_CONTAINS
filters.You can’t have both a
CONTAINS
filter and aNOT_CONTAINS
filter on the same field. Similarly, you can’t have both anEQUALS
filter and aNOT_EQUALS
filter on the same field. Combining filters in this way returns an error.CONTAINS
andNOT_CONTAINS
operators can be used only with automation rules. For more information, see Automation rules in the AWS Security Hub User Guide.Required: Yes
Type: String
Allowed values:
EQUALS | NOT_EQUALS | CONTAINS | NOT_CONTAINS
Update requires: No interruption
-
Key
-
The key of the map filter. For example, for
ResourceTags
,Key
identifies the name of the tag. ForUserDefinedFields
,Key
is the name of the field.Required: Yes
Type: String
Pattern:
.*\S.*
Update requires: No interruption
Value
-
The value for the key in the map filter. Filter values are case sensitive. For example, one of the values for a tag called
Department
might beSecurity
. If you providesecurity
as the filter value, then there's no match.Required: Yes
Type: String
Pattern:
.*\S.*
Update requires: No interruption